3 ms·
If a line of text like that can cause tangible harm, why are you pointing your LLM at unvetted code? As an engineer, you're downright negligent to do so.
by vkou 4mo ago
If a line of text like that can cause tangible harm, why are you pointing your LLM at unvetted code? As an engineer, you're downright negligent to do so.
- asdfasgasdgasdg 4mo agoI think it is extremely rare to vet every single line of one's dependencies. Especially lines that are intentionally hidden from the terminal using escape sequences. Do you review the diffs of all projects you depend on to check for the injection of malware? If so, my hat is off to you and also how do you get anything else done?
- vkou 4mo agoThen why are you letting a machine you don't understand perform side effects that you don't vet, based on it's insane interpretation of untrusted data?
- asdfasgasdgasdg 4mo agoSorry, I just don’t think this is a tenable or realistic way to approach dependencies in this day and age. If it works for you then I’m happy for you tho.
- yjftsjthsd-h 4mo ago> Then why are you letting a machine you don't understand perform side effects that you don't vet, based on it's insane interpretation of untrusted data? I mean, you posted this using a browser, right?
- vkou 4mo agoNeither my browser nor my brain will just run whatever commands it receives over a socket as root.
- yjftsjthsd-h 4mo agoBrowsers (and humans, actually) are subject to bugs that make them execute arbitrary commands from an attacker, and LLMs can be told to ignore undesired commands.
- vkou 4mo agoSo go tell your LLM to ignore undesired commands, and this ends up a nothingburger that nobody should be upset over.
- yjftsjthsd-h 4mo agoIf you intentionally send me a virus-laden email attachment, I'm going to be justifiably unhappy even if my antivirus catches it.
- vkou 4mo agoUnlike sending you an email, nobody's pushing you anything, though. You are actively pulling a program that explicitly says that you should not use it with an AI system. It's like pulling a bunch of GPL code into your product and then complaining that it 'infected' the rest of your code. You actively chose to do that, nobody forced it upon you.